Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: dapr/java-sdk
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v1.17.4
Choose a base ref
...
head repository: dapr/java-sdk
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v1.17.5
Choose a head ref
  • 3 commits
  • 648 files changed
  • 2 contributors

Commits on Jul 17, 2026

  1. fix: bump dependencies for CVE fixes on release-1.17 (#1789) 

    Mirror the 1.18 CVE fixes (#1788) and address FOSSA findings:

- netty 4.1.132 -> 4.1.135.Final (CVE-2026-41417, CVE-2026-42578,
  CVE-2026-42580..42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-47244,
  CVE-2026-48043, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560)
- jackson 2.21.2 -> 2.21.5 and Jackson 3 BOM 3.1.1 -> 3.1.4
  (CVE-2026-54512..54518)
- opentelemetry 1.41.0 -> 1.62.0 (CVE-2026-45292), imported before the
  Spring Boot BOM so the override wins
- logback 1.5.25 -> 1.5.35 (CVE-2026-9828, CVE-2026-10532)
- tomcat 10.1.52 -> 10.1.55 (CVE-2026-25854, CVE-2026-29129,
  CVE-2026-32990, CVE-2026-34483, CVE-2026-41284, CVE-2026-41293,
  CVE-2026-42498, CVE-2026-43512..43515)
- spring-framework-bom 6.2.18 override (CVE-2026-22735, CVE-2026-22737,
  CVE-2026-22741, CVE-2026-22745)
- Spring Boot 4 modules 4.0.5 -> 4.0.6 (CVE-2026-40973)
- Jackson 2.x/OTel BOM imports added ahead of the local Spring Boot 4
  BOMs so module resolution does not downgrade the fixed versions

CVE-2026-40973 remains on spring-boot 3.4.13: no fix exists on the
OSS-EOL 3.4.x line; accepted and ignored in FOSSA.

Signed-off-by: Javier Aliaga <[email protected]>
    @javier-aliaga
    javier-aliaga authored Jul 17, 2026
    Configuration menu
    Copy the full SHA
    9cac5e7 View commit details
    Browse the repository at this point in the history

Commits on Jul 20, 2026

  1. Release 1.17.5 

    Signed-off-by: Dapr Bot <[email protected]>
    @dapr-bot
    dapr-bot committed Jul 20, 2026
    Configuration menu
    Copy the full SHA
    bae5c18 View commit details
    Browse the repository at this point in the history

  2. Generate updated javadocs for 1.17.5 

    Signed-off-by: Dapr Bot <[email protected]>
    @dapr-bot
    dapr-bot committed Jul 20, 2026
    Configuration menu
    Copy the full SHA
    afc0d27 View commit details
    Browse the repository at this point in the history
Loading